Series · Privacy

Privacy & encryption

DRAFT — Law Specialist final pass 2026-11-04 (DSS facts). Series overview cleared for structure; binding policies remain per-app pages. Replace contact email before any public or store use. “No ads” still needs SDK inventory.

Privacy & encryption at Life Tracker

Series overview only. The binding policy for each product is the per-app privacy page.

How end-to-end encryption works (overview) — live facts

  • What is end-to-end encrypted today: personal Budget ledger rows that use the encrypted (enc) path. Those are sealed on your device before sync. We designed that path so staff cannot read that content; the server stores ciphertext plus limited metadata.
  • What is not end-to-end encrypted today: account email and auth identifiers; sync metadata (for example timestamps, record ids, sizes); Budget shared / group spaces (plaintext by design until group encryption ships — invited members can see that content, and it is stored on our servers); Habit synced content, including Health / Health Connect data when you opt in (plaintext today until a Habit encryption migration ships); Recipe synced library (live Recipe tables are plaintext; no enc / ciphertext path yet). Do not assume every “personal entry” across the series is E2EE.
  • Key backup / recovery (Budget E2EE): the server holds wrapped recovery material only. Staff do not unwrap it. If you lose both your passphrase and your 12-word recovery phrase, end-to-end encrypted Budget content cannot be reconstructed. Resetting your login password is not the same as recovering encryption keys. Recovery attempts are rate-limited (live: 5 per hour and 15 per day).
  • Unlocked device risk: someone with your unlocked phone, tablet, or Mac session may access apps and data the way you can.
  • Cross-app insights: designed to stay on-device with no upload of insight results — not shipped yet. We will not market them as available until they are.

Hosting

Synced data is hosted with Supabase in us-east-1 (United States). Supabase’s public DPA and subprocessor documentation apply; whether our organization has a separately signed DPA on file is TBD before launch. See each app’s privacy policy for the full processor list.

Per-app privacy policies

Contact

support@example.invalid (placeholder until launch — replace before any public or store use)